Skip to content

Commit eeeb7b4

Browse files
lundmanlundman
committed
Update codeql run for successful build
Signed-off-by: Jorgen Lundman <lundman@lundman.net>
1 parent 5b0fbe7 commit eeeb7b4

1 file changed

Lines changed: 143 additions & 57 deletions

File tree

‎.github/workflows/codeql-windows.yml‎

Lines changed: 143 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,155 @@
1-
######################################################################################
2-
# #
3-
# If you're looking for instructions on how to build this under windows go to #
4-
#https://github.com/openzfsonwindows/openzfs/blob/windows/module/os/windows/README.md#
5-
# #
6-
######################################################################################
1+
#
2+
# This based on work that Andrew Innes <andrew.c12@gmail.com> did for OpenZFSonWindows,
3+
# reworked for me to understand what it did, so I can support it myself.
4+
# - Lundman
5+
#
76

8-
name: "CodeQL windows"
7+
name: CodeQL Windows
98

109
on:
1110
push:
11+
branches:
12+
- zfs-Windows-*-release
13+
tags-ignore:
14+
- '*'
1215
pull_request:
16+
branches:
17+
- zfs-Windows-*-release
18+
workflow_dispatch:
1319

14-
env:
15-
# Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
16-
BUILD_TYPE: Debug
20+
concurrency:
21+
group: windows-build-${{ github.ref }}
22+
cancel-in-progress: true
1723

1824
jobs:
1925
analyze:
20-
name: Analyze
21-
timeout-minutes: 120
22-
# The CMake configure and build commands are platform agnostic and should work equally well on Windows or Mac.
23-
# You can convert this to a matrix build if you need cross-platform coverage.
24-
# See: https://docs.github.com/en/free-pro-team@latest/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix
2526
runs-on: windows-latest
26-
permissions:
27-
actions: read
28-
contents: read
29-
security-events: write
27+
timeout-minutes: 10
3028

3129
steps:
32-
- uses: ilammy/msvc-dev-cmd@v1
33-
34-
- uses: actions/checkout@v3
35-
with:
36-
#repository: openzfsonwindows/openzfs
37-
fetch-depth: 0
38-
39-
- name: Import signing certificate
40-
run: |
41-
$plaintextpwd = 'password1234'
42-
$pwd = ConvertTo-SecureString -String $plaintextpwd -Force -AsPlainText
43-
Import-PfxCertificate -FilePath ${{github.workspace}}/contrib/windows/TestCert/test_sign_cert_pass.pfx -CertStoreLocation Cert:\CurrentUser\My -Password $pwd -Exportable
44-
45-
- name: Checkout openssl
46-
uses: actions/checkout@v3
47-
with:
48-
repository: andrewc12/openssl # optional, default is ${{ github.repository }}
49-
path: openssl # optional
50-
51-
# Initializes the CodeQL tools for scanning.
52-
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@v2
54-
# Override language selection by uncommenting this and choosing your languages
55-
with:
56-
languages: cpp
57-
58-
- name: Configure CMake
59-
# Configure CMake in a 'build' subdirectory. `CMAKE_BUILD_TYPE` is only required if you are using a single-configuration generator such as make.
60-
# See https://cmake.org/cmake/help/latest/variable/CMAKE_BUILD_TYPE.html?highlight=cmake_build_type
61-
run: cmake -G "Ninja" -B ${{github.workspace}}/out/build/x64-Debug ${{github.workspace}} -DOPENSSL_ROOT_DIR=${{github.workspace}}/openssl/ -DCRYPTO_STATIC_TEST=${{github.workspace}}/openssl/lib/VC/static/libcrypto64MTd.lib -DLIB_EAY_DEBUG=${{github.workspace}}/openssl/lib/VC/static/libcrypto64MTd.lib -DLIB_EAY_RELEASE=${{github.workspace}}/openssl/lib/VC/static/libcrypto64MT.lib -DOPENSSL_INCLUDE_DIR=${{github.workspace}}/openssl/include -DSSL_EAY_DEBUG=${{github.workspace}}/openssl/lib/VC/static/libssl64MTd.lib -DSSL_EAY_RELEASE=${{github.workspace}}/openssl/lib/VC/static/libssl64MT.lib
62-
63-
- name: Build
64-
working-directory: ${{github.workspace}}/out/build/x64-Debug
65-
# Build your program with the given configuration
66-
run: cmake --build ${{github.workspace}}/out/build/x64-Debug
67-
68-
- name: Perform CodeQL Analysis
69-
uses: github/codeql-action/analyze@v2
30+
- name: Enter MSVC dev environment
31+
uses: ilammy/msvc-dev-cmd@v1
32+
33+
- name: Checkout OpenZFS
34+
uses: actions/checkout@v5
35+
with:
36+
fetch-depth: 0
37+
submodules: recursive
38+
39+
- name: Checkout OpenSSL
40+
uses: actions/checkout@v5
41+
with:
42+
repository: openzfsonwindows/openssl
43+
ref: openssl-3.5.5
44+
path: openssl
45+
46+
- name: Initialize CodeQL
47+
uses: github/codeql-action/init@v3
48+
with:
49+
languages: c-cpp
50+
build-mode: manual
51+
52+
- name: Create OpenZFS test signing certificate
53+
shell: pwsh
54+
run: |
55+
$certSubject = "OpenZFS Test Signing Certificate"
56+
$pfxPath = "$env:RUNNER_TEMP\openzfs-test-signing.pfx"
57+
$pfxPassword = "password123"
58+
$pwd = ConvertTo-SecureString $pfxPassword -AsPlainText -Force
59+
60+
$cert = New-SelfSignedCertificate `
61+
-Subject "CN=$certSubject" `
62+
-Type CodeSigningCert `
63+
-CertStoreLocation "Cert:\CurrentUser\My" `
64+
-HashAlgorithm SHA256 `
65+
-KeyAlgorithm RSA `
66+
-KeyLength 2048 `
67+
-KeyExportPolicy Exportable `
68+
-NotAfter (Get-Date).AddDays(30)
69+
70+
if (-not $cert) {
71+
throw "Failed to create test signing certificate"
72+
}
73+
74+
Export-PfxCertificate `
75+
-Cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" `
76+
-FilePath $pfxPath `
77+
-Password $pwd | Out-Null
78+
79+
if (-not (Test-Path $pfxPath)) {
80+
throw "Failed to export PFX"
81+
}
82+
83+
"OPENZFS_SIGNTOOL_CERTSTORE=My" | Out-File -FilePath $env:GITHUB_ENV -Append
84+
"OPENZFS_SIGNTOOL_CERTNAME=$certSubject" | Out-File -FilePath $env:GITHUB_ENV -Append
85+
"OPENZFS_SIGNTOOL_SHA1=$($cert.Thumbprint)" | Out-File -FilePath $env:GITHUB_ENV -Append
86+
"OPENZFS_SIGNTOOL_TSA=http://timestamp.digicert.com" | Out-File -FilePath $env:GITHUB_ENV -Append
87+
"OPENZFS_TEST_CERT_PFX=$pfxPath" | Out-File -FilePath $env:GITHUB_ENV -Append
88+
"OPENZFS_TEST_CERT_PASSWORD=$pfxPassword" | Out-File -FilePath $env:GITHUB_ENV -Append
89+
90+
Write-Host "Created certificate:"
91+
Write-Host " Subject: $certSubject"
92+
Write-Host " Store: My"
93+
Write-Host " Thumbprint: $($cert.Thumbprint)"
94+
Write-Host " PFX: $pfxPath"
95+
96+
- name: Install WDK via NuGet
97+
shell: pwsh
98+
run: |
99+
nuget install Microsoft.Windows.WDK.x64 `
100+
-Version 10.0.26100.6584 `
101+
-OutputDirectory "${{ github.workspace }}\packages" `
102+
-Source https://api.nuget.org/v3/index.json
103+
104+
- name: Set WDK and SDK roots
105+
shell: pwsh
106+
run: |
107+
$wdk = Get-ChildItem "${{ github.workspace }}\packages" -Directory |
108+
Where-Object { $_.Name -like "Microsoft.Windows.WDK.x64.*" } |
109+
Sort-Object Name -Descending |
110+
Select-Object -First 1
111+
112+
$sdk = Get-ChildItem "${{ github.workspace }}\packages" -Directory |
113+
Where-Object { $_.Name -like "Microsoft.Windows.SDK.CPP.*" -and $_.Name -notlike "*.x64.*" } |
114+
Sort-Object Name -Descending |
115+
Select-Object -First 1
116+
117+
if (-not $wdk) { throw "WDK package directory not found" }
118+
if (-not $sdk) { throw "SDK package directory not found" }
119+
120+
$env:WDKContentRoot = Join-Path $wdk.FullName "c"
121+
$env:WINSDK_NUGET_ROOT = Join-Path $sdk.FullName "c"
122+
123+
"WDKContentRoot=$env:WDKContentRoot" | Out-File -FilePath $env:GITHUB_ENV -Append
124+
"WINSDK_NUGET_ROOT=$env:WINSDK_NUGET_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
125+
126+
Write-Host "WDKContentRoot=$env:WDKContentRoot"
127+
Write-Host "WINSDK_NUGET_ROOT=$env:WINSDK_NUGET_ROOT"
128+
129+
- name: Configure CMake
130+
shell: pwsh
131+
run: |
132+
cmake -G "Ninja" `
133+
-B "${{ github.workspace }}/out/build/x64-Debug" `
134+
"${{ github.workspace }}" `
135+
-DOPENSSL_ROOT_DIR="${{ github.workspace }}/openssl" `
136+
-DOPENSSL_INCLUDE_DIR="${{ github.workspace }}/openssl/include/x64" `
137+
-DCRYPTO_STATIC_TEST="${{ github.workspace }}/openssl/lib/VC/x64/MTd/libcrypto_static.lib" `
138+
-DLIB_EAY_DEBUG="${{ github.workspace }}/openssl/lib/VC/x64/MTd/libcrypto_static.lib" `
139+
-DLIB_EAY_RELEASE="${{ github.workspace }}/openssl/lib/VC/x64/MT/libcrypto_static.lib" `
140+
-DSSL_EAY_DEBUG="${{ github.workspace }}/openssl/lib/VC/x64/MTd/libssl_static.lib" `
141+
-DSSL_EAY_RELEASE="${{ github.workspace }}/openssl/lib/VC/x64/MT/libssl_static.lib" `
142+
-DOPENZFS_SIGNTOOL_CERTSTORE="$env:OPENZFS_SIGNTOOL_CERTSTORE" `
143+
-DOPENZFS_SIGNTOOL_CERTNAME="$env:OPENZFS_SIGNTOOL_CERTNAME" `
144+
-DOPENZFS_SIGNTOOL_SHA1="$env:OPENZFS_SIGNTOOL_SHA1" `
145+
-DOPENZFS_SIGNTOOL_TSA="$env:OPENZFS_SIGNTOOL_TSA"
146+
147+
- name: Build
148+
shell: pwsh
149+
run: |
150+
cmake --build "${{ github.workspace }}/out/build/x64-Debug" --parallel
151+
152+
- name: Analyze
153+
uses: github/codeql-action/analyze@v3
154+
155+

0 commit comments

Comments
 (0)